Subject: Re: 10.4 IDENTIFY Command II

From: Doug Royer <[email-masked]>
Date: Wed, 04 Dec 2002 15:05:59 -0700

[email-masked] wrote:
> 
> Doug wrote on 11/18/2002 12:26:47 PM:
>  > >  Kinda illogical to me.
>  > >  If the command succeeded then I should be allowed in.
>  >
>  > Where does the draft say that if it succeeds that you are not allowed in?
> 
> Go reread BEEP where it talks about this apparent paradox.  See Section 
> 3.1.1 Profile Identification and Initialization.  Its not 100% a 1-to-1 
> mappable example to CAP but its a scenario where it can occur.  In any 
> case the main topic here is the way CAP deals with failures, etc.

I see that the channel can be created and the authentication to fail.
But I do not see that you are 'allowed in' [to a CS].

-- 

  Doug Royer                     |   http://INET-Consulting.com
  -------------------------------|-----------------------------
  [email-masked]                 | Office: (208)612-INET
  http://Royer.com/People/Doug   |    Fax: (866)594-8574
                                 |   Cell: (208)520-4044

                 We Do Standards - You Need Standards

---

From: Doug Royer <[email-masked]>
Date: Wed, 04 Dec 2002 15:08:41 -0700

[email-masked] wrote:
>
>  > If you determined that a hacker was attacking your system, would
>  > you first inform them:
>  >
>  >    > 1: Network failure
>  >    > 2: CS crash/shutdown
>  >    > 3: "Im a bad boy"
>  >    > 4: "Im not allowed to be the CFO of the company"
>  >    > 5: "Sorry C&S Team AA, you are still not allowed to assume 
> Bruces identity"
>  >    > ...
> 
> Hmm, Im impressed that you alone have developed the means to make 
> software clairvoyant and have imbued it with the ability to tell a 
> hacker from a legitimate user who is retrying something they think 
> should/will work.

I have made no such claim. I claimed that if I detect
a hacker - I am dropping the connection and I think
that is good protocol practice.

--